7.8

CVE-2026-43033: linux Incorrect Calculation

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2026-43033DEBIAN-CVE-2026-43033CGA-36g7-qr99-22gx
Published 01-05-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-43033 is a high (CVSS 7.8) Incorrect Calculation vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.4% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · +0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 28 · Related 49
MGASA-2026-0108MGASA-2026-0110OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1

Timeline

  1. 01-05-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits in dst as it could simply be re-copied from the source. However, the data to be hashed need to be rearranged accordingly. Thanks,

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

+0.05 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu156 products
  • linuxAll versions (No fix recorded) | < 4.15.0-250.262 | < 5.4.0-230.250 | < 5.15.0-179.189 | < 6.8.0-117.117 | < 6.17.0-29.29
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1192.205 | < 5.4.0-1159.169 | < 5.15.0-1108.115 | < 6.8.0-1055.58 | < 6.17.0-1015.15
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Chainguard5 products
  • linux-aws-6.12< 6.12.85-r2
  • linux-azure-6.12< 6.12.85-r2
  • linux-gcp-6.12< 6.12.85-r2
  • linux-qemu-6.12< 6.12.85-r2
  • linux-vmware-6.12< 6.12.85-r2
Linux2 products
  • linux≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < 8c62f618576519dbed6816fafc623ce592953025 | ≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < d589abd8b019b07075fda255ceab8c8e950cdb3f | ≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < 5466e7d0cd9e4f9cef9d8f18f18b60e7bc1c77e5 | ≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < d0c4ff6812386880f30bc64c2921299cc4d7b47f | ≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < 89fe118b6470119b20c04afc36e45b81a69ea11f | ≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < 153d5520c3f9fd62e71c7e7f9e34b59cf411e555 | ≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < cded4002d22177e8deaca1f257ecd932c9582b6b | ≥ 104880a6b470958ddc30e139c41aa4f6ed3a5234, < e02494114ebf7c8b42777c6cd6982f113bfdbec7 | 4.3
  • linux_kernel≥ 4.3, < 5.10.254 | ≥ 5.11, < 5.15.204 | ≥ 5.16, < 6.1.170 | ≥ 6.2, < 6.6.137 | ≥ 6.7, < 6.12.85 | ≥ 6.13, < 6.18.22 | ≥ 6.19, < 6.19.12 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.12-1

4 vendors · 164 products

References

49 links
Show all 49 references